> ## Documentation Index
> Fetch the complete documentation index at: https://vlyai-1c28d863.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> How vly stores, encrypts, and serves secrets. Per-environment scoping, rotation, audit.

vly's secret store is a vault for API keys, webhook signing secrets, OAuth client secrets, and any other server-only sensitive values.

## How it works

* Stored encrypted at rest with AES-256.
* Decrypted only at function invocation, only on vly-controlled compute.
* Never exposed to client code.
* Never displayed in plain text in the UI after creation (you can rotate but not view).

## Setting

Same as [Environment variables](/deployment/environment-variables) — server-only env vars *are* secrets.

## Audit

Every secret read is **not** logged (would generate too much noise). Every secret create / update / delete **is** audit-logged.

To see who touched a secret: Settings → Audit log → filter by action `secret.*`.

## Rotation policy

Recommended:

* Rotate quarterly for routine secrets.
* Rotate immediately if you suspect compromise (a developer leaves; a key was leaked).
* Rotate at provider AND vly to avoid downtime.

## Compromise response

If a secret is leaked:

<Steps>
  <Step title="Revoke immediately at the provider">
    Stripe / Resend / OpenAI dashboard → Revoke key.
  </Step>

  <Step title="Generate a replacement">
    New key at the provider.
  </Step>

  <Step title="Update in vly">
    Settings → Environments → \[env] → Variables → Edit.
  </Step>

  <Step title="Audit usage">
    Check audit log for unexpected secret reads or downstream API calls.
  </Step>

  <Step title="Notify if needed">
    If user data was at risk, follow your incident-response process.
  </Step>
</Steps>

## What's NOT a secret

* Public API keys (Stripe `pk_`, PostHog public key) — set as `VITE_*` so they reach the client.
* App URLs — also `VITE_*`.

## Related

<CardGroup cols={3}>
  <Card title="Secrets management" icon="key" href="/security/secrets-management">
    Best practices.
  </Card>

  <Card title="Environment variables" icon="key-round" href="/deployment/environment-variables">
    The configuration mechanism.
  </Card>

  <Card title="Audit logs" icon="scroll-text" href="/features/workspace/audit-logs">
    Tracking secret changes.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.